Page MenuHomeVyOS Platform
Files F117520800

No OneTemporary
Actions

Size
12 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/data/templates/ids/fastnetmon.tmpl b/data/templates/ids/fastnetmon.tmpl
new file mode 100644
index 000000000..71a1b2bd7
--- /dev/null
+++ b/data/templates/ids/fastnetmon.tmpl
@@ -0,0 +1,60 @@
+# enable this option if you want to send logs to local syslog facility
+logging:local_syslog_logging = on
+
+# list of all your networks in CIDR format
+networks_list_path = /etc/networks_list
+
+# list networks in CIDR format which will be not monitored for attacks
+white_list_path = /etc/networks_whitelist
+
+# Enable/Disable any actions in case of attack
+enable_ban = on
+
+## How many packets will be collected from attack traffic
+ban_details_records_count = 500
+
+## How long (in seconds) we should keep an IP in blocked state
+## If you set 0 here it completely disables unban capability
+ban_time = 1900
+
+# Check if the attack is still active, before triggering an unban callback with this option
+# If the attack is still active, check each run of the unban watchdog
+unban_only_if_attack_finished = on
+
+# enable per subnet speed meters
+# For each subnet, list track speed in bps and pps for both directions
+enable_subnet_counters = off
+
+{% if "mirror" in mode %}
+mirror_afpacket = on
+{% endif -%}
+
+{% if "in" in direction %}
+process_incoming_traffic = on
+{% endif -%}
+{% if "out" in direction %}
+process_outgoing_traffic = on
+{% endif -%}
+{% for th in threshold %}
+{% if th == "fps" %}
+ban_for_flows = on
+threshold_flows = {{ threshold[th] }}
+{% endif -%}
+{% if th == "mbps" %}
+ban_for_bandwidth = on
+threshold_mbps = {{ threshold[th] }}
+{% endif -%}
+{% if th == "pps" %}
+ban_for_pps = on
+threshold_pps = {{ threshold[th] }}
+{% endif -%}
+{% endfor -%}
+
+{% if listen_interface %}
+{% set value = listen_interface if listen_interface is string else listen_interface | join(',') %}
+interfaces = {{ value }}
+{% endif -%}
+
+{% if alert_script %}
+notify_script_path = {{ alert_script }}
+{% endif -%}
diff --git a/data/templates/ids/fastnetmon_networks_list.tmpl b/data/templates/ids/fastnetmon_networks_list.tmpl
new file mode 100644
index 000000000..d58990053
--- /dev/null
+++ b/data/templates/ids/fastnetmon_networks_list.tmpl
@@ -0,0 +1,7 @@
+{% if network is string %}
+{{ network }}
+{% else %}
+{% for net in network %}
+{{ net }}
+{% endfor %}
+{% endif %}
diff --git a/debian/control b/debian/control
index d2a1ad54c..6746fe647 100644
--- a/debian/control
+++ b/debian/control
@@ -1,117 +1,119 @@
Source: vyos-1x
Section: contrib/net
Priority: extra
Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
Build-Depends: debhelper (>= 9),
quilt,
python3,
python3-setuptools,
python3-xmltodict,
python3-lxml,
python3-nose,
python3-coverage,
whois,
fakeroot,
libvyosconfig0 (>= 0.0.7)
Standards-Version: 3.9.6
Package: vyos-1x
Architecture: all
Depends: python3,
${python3:Depends},
python3-netifaces,
python3-jinja2,
python3-pystache,
python3-psutil,
python3-tabulate,
python3-six,
python3-isc-dhcp-leases,
python3-hurry.filesize,
python3-vici (>= 5.7.2),
python3-flask,
python3-waitress,
python3-netaddr,
python3-zmq,
python3-jmespath,
python3-xmltodict,
python3-pyudev,
python3-voluptuous,
bsdmainutils,
cron,
etherwake,
systemd,
easy-rsa,
ipaddrcheck,
tcpdump,
isc-dhcp-client,
wide-dhcpv6-client,
bmon,
hvinfo,
lm-sensors,
file,
lsscsi,
pciutils,
usbutils,
procps,
snmp, snmpd,
openssh-server,
ntp,
ntpdate,
iputils-arping,
libvyosconfig0,
beep,
dropbear,
conserver-server,
conserver-client,
isc-dhcp-server,
isc-dhcp-relay,
keepalived (>=2.0.5),
wireguard,
tftpd-hpa,
igmpproxy,
accel-ppp,
mdns-repeater,
udp-broadcast-relay,
pdns-recursor,
lcdproc,
lcdproc-extra-drivers,
openvpn,
openvpn-auth-ldap,
openvpn-auth-radius,
libpam-radius-auth (>= 1.5.0),
mtr-tiny,
telnet,
traceroute,
ssl-cert,
nginx-light,
lldpd,
iperf,
iperf3,
frr,
frr-pythontools,
radvd,
dbus,
usb-modeswitch,
hostapd (>= 0.6.8),
wpasupplicant (>= 0.6.7),
iw,
crda,
wireless-regdb,
pmacct (>= 1.6.0),
python3-certbot-nginx,
pppoe,
salt-minion,
vyos-utils,
nftables (>= 0.9.3),
- conntrack
+ conntrack,
+ libatomic1,
+ fastnetmon
Description: VyOS configuration scripts and data
VyOS configuration scripts, interface definitions, and everything
Package: vyos-1x-vmware
Architecture: amd64 i386
Depends:
vyos-1x,
open-vm-tools
Description: VyOS configuration scripts and data for VMware
Adds configuration files required for VyOS running on VMware hosts.
diff --git a/interface-definitions/service-ids-ddos-protection.xml.in b/interface-definitions/service-ids-ddos-protection.xml.in
new file mode 100644
index 000000000..741533bb4
--- /dev/null
+++ b/interface-definitions/service-ids-ddos-protection.xml.in
@@ -0,0 +1,117 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+ <node name="service">
+ <children>
+ <node name="ids">
+ <properties>
+ <help>Intrusion Detection System</help>
+ </properties>
+ <children>
+ <node name="ddos-protection" owner="${vyos_conf_scripts_dir}/service_ids_fastnetmon.py">
+ <properties>
+ <help>FastNetMon detection and protection parameters</help>
+ </properties>
+ <children>
+ <leafNode name="alert-script">
+ <properties>
+ <help>Path to fastnetmon alert script</help>
+ </properties>
+ </leafNode>
+ <leafNode name="direction">
+ <properties>
+ <help>Direction for processing traffic</help>
+ <completionHelp>
+ <list>in out</list>
+ </completionHelp>
+ <constraint>
+ <regex>(in|out)</regex>
+ </constraint>
+ <multi/>
+ </properties>
+ </leafNode>
+ <leafNode name="listen-interface">
+ <properties>
+ <help>Listen interface for mirroring traffic</help>
+ <completionHelp>
+ <script>${vyos_completion_dir}/list_interfaces.py</script>
+ </completionHelp>
+ <multi/>
+ </properties>
+ </leafNode>
+ <node name="mode">
+ <properties>
+ <help>Traffic capture modes</help>
+ </properties>
+ <children>
+ <!-- Future modes "mirror" "netflow" "combine (both)" -->
+ <leafNode name="mirror">
+ <properties>
+ <help>Listen mirrored traffic mode</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
+ <leafNode name="network">
+ <properties>
+ <help>Define monitoring networks</help>
+ <valueHelp>
+ <format>ipv4net</format>
+ <description>Processed network</description>
+ </valueHelp>
+ <constraint>
+ <validator name="ipv4-prefix"/>
+ </constraint>
+ <multi/>
+ </properties>
+ </leafNode>
+ <node name="threshold">
+ <properties>
+ <help>Attack limits thresholds</help>
+ </properties>
+ <children>
+ <leafNode name="fps">
+ <properties>
+ <help>Flows per second</help>
+ <valueHelp>
+ <format>&lt;0-4294967294&gt;</format>
+ <description>Flows per second</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 0-4294967294"/>
+ </constraint>
+ </properties>
+ </leafNode>
+ <leafNode name="mbps">
+ <properties>
+ <help>Megabits per second</help>
+ <valueHelp>
+ <format>&lt;0-4294967294&gt;</format>
+ <description>Megabits per second</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 0-4294967294"/>
+ </constraint>
+ </properties>
+ </leafNode>
+ <leafNode name="pps">
+ <properties>
+ <help>Packets per second</help>
+ <valueHelp>
+ <format>&lt;0-4294967294&gt;</format>
+ <description>Packets per second</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 0-4294967294"/>
+ </constraint>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
+ </children>
+ </node>
+ </children>
+ </node>
+ </children>
+ </node>
+</interfaceDefinition>
diff --git a/src/conf_mode/service_ids_fastnetmon.py b/src/conf_mode/service_ids_fastnetmon.py
new file mode 100755
index 000000000..71bef08ae
--- /dev/null
+++ b/src/conf_mode/service_ids_fastnetmon.py
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2020 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos import ConfigError
+from vyos.util import call
+from vyos.template import render
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/etc/fastnetmon.conf'
+networks_list = r'/etc/networks_list'
+
+def get_config():
+ conf = Config()
+ base = ['service', 'ids', 'ddos-protection']
+ fastnetmon = conf.get_config_dict(base, key_mangling=('-', '_'))
+ return fastnetmon
+
+def verify(fastnetmon):
+ if not fastnetmon:
+ return None
+
+ if not "mode" in fastnetmon:
+ raise ConfigError('ddos-protection mode is mandatory!')
+
+ if not "network" in fastnetmon:
+ raise ConfigError('Required define network!')
+
+ if not "listen_interface" in fastnetmon:
+ raise ConfigError('Define listen-interface is mandatory!')
+
+ if "alert_script" in fastnetmon:
+ if os.path.isfile(fastnetmon["alert_script"]):
+ # Check script permissions
+ if not os.access(fastnetmon["alert_script"], os.X_OK):
+ raise ConfigError('Script {0} does not have permissions for execution'.format(fastnetmon["alert_script"]))
+ else:
+ raise ConfigError('File {0} does not exists!'.format(fastnetmon["alert_script"]))
+
+def generate(fastnetmon):
+ if not fastnetmon:
+ if os.path.isfile(config_file):
+ os.unlink(config_file)
+ if os.path.isfile(networks_list):
+ os.unlink(networks_list)
+
+ return
+
+ render(config_file, 'ids/fastnetmon.tmpl', fastnetmon, trim_blocks=True)
+ render(networks_list, 'ids/fastnetmon_networks_list.tmpl', fastnetmon, trim_blocks=True)
+
+ return None
+
+def apply(fastnetmon):
+ if not fastnetmon:
+ # Stop fastnetmon service if removed
+ call('systemctl stop fastnetmon.service')
+ else:
+ call('systemctl restart fastnetmon.service')
+
+ return None
+
+if __name__ == '__main__':
+ try:
+ c = get_config()
+ verify(c)
+ generate(c)
+ apply(c)
+ except ConfigError as e:
+ print(e)
+ exit(1)

File Metadata

Mime Type
text/x-diff
Expires
Sat, Sep 26, 12:22 PM (1 d, 23 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4285123
Default Alt Text
(12 KB)

Event Timeline